Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7154f6bda27c0bb…

MALICIOUS

PDF

36.1 KB Authoring application: Scribus
MD5: a414696b67478adfb8b13e6f53edf43f SHA-1: 77a4a7a194a37f5950d9f660edd4afc4d2456f9c SHA-256: b7154f6bda27c0bb3d236abb3524a4f8d0d75520cda69cbb8007044b1c32026b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file was detected as malicious by ClamAV and a machine learning classifier, indicating a high likelihood of malicious intent. The presence of multiple embedded URLs, including one directly flagged by a PDF_URI heuristic, suggests a phishing or social engineering lure. The document body, though heavily obfuscated, contains URLs that are likely intended to redirect the user to malicious content, such as the PDF at http://stakemycoin.com/uploads/1/3/0/4/130488846/letirapem.pdf.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stakemycoin.com/uploads/1/3/0/4/130488846/letirapem.pdf
    • http://jevolare.paypal-support-limitted.com/uploads/2020/01/28/levanax.pdf
    • http://joyceandcraig.com/uploads/1/3/0/2/130272270/pudube.pdf
    • http://cours-de-batterie-fouesnant.com/uploads/1/3/0/2/130289523/1942977.pdf
    • http://dmtraining.net/uploads/1/3/0/4/130476816/130476816.html#reaccion+de+xantoproteica

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011bc.bin
f9d68e8a9dac18f2768226f15406e8ca6b6fb328609360607a45162d5c731a32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BC 9100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.